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AMENDMENTS TO THE CLAIMS; 

Applicant hereby amends claims as indicated below. The following listing of claims will 
replace all prior versions and listings of claims in the application. 

LISTING OF CLAIMS: 

1-16. (Cancelled) 

17. (Currently amended) A method as defined in Claim 15. for identifying problems in a 
network environment by a network analyzer operatively connected to a network, the 
method comprising the steps of: 

a. determining, by said network analyzer, during more than one interval, the 
level of one or more impairments, wherein determining the level of said one or 
more impairments includes: 

I applying a local timestamp to a packet corresponding to the actual 
arrival time of said packet; 

iL extracting a sending timestamp from said packet; 

Hi. extracting a sending sequence number from said packet; 

iv. estimating an expected arrival time for said packet; and 

v. subtracting the actual arrival time of said packet from the expected 
arrival time of said packet; 

b. grouping, by said network analyzer, said levels of one or more impairments 
into one or more event groups; 

c. comparing, by said network analyzer, said one or more event groups with a 
plurality of problem signatures; and 

d. categorizing, by said network analyzer, at least one of said one or more event 
groups as being associated with a network problem having one of said 
plurality of problem signatures; 
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wherein said one or more plurality of problem signatures includes: 

a. a high value of short term delay variation without an increase in delay; 

b. an increase in delay accompanied by an increase in short term delay variation 
followed by a decrease in delay; or 

c. an increase or decrease in delay accompanied by a substantially constant level 
of short term delay variation; 

wherein said one or more impairments is selected from the group consisting of delay, 
packet loss, jitter, distortion, absolute packet delay variation, relative packet to packet 
delay variation, short term delay variation, short term average delay, timing drift, and 
proportion of out-of-sequence packets; and 

wherein said network problem is selected from the group consisting of local area 
network congestion, access link congestion, route change, access link failure, route 
flapping, and route diversity . 

18. (Currently amended) A method as defined in Claim 15, for identifying problems in a 
network environment by a network analyzer operatively connected to a network, the 
method comprising the steps of: 

a. determining, by said network analyzer, during more than one interval, the 
level of one or more impairments, wherein determining the level of said one or 
more impairments includes: 

i. applying a local timestamp to a packet corresponding to the actual 
arrival time of said packet; 

H. extracting a sending timestamp from said packet; 

iii. extracting a sending sequence number from said packet; 

iv. estimating an expected arrival time for said packet; and 

v. subtracting the actual arrival time of said packet from the expected 
arrival time of said packet; 
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b. grouping, by said network analyzer, said levels of one or more impairments 
into one or more event groups; 

c. comparing, by said network analyzer, said one or more event groups with a 
plurality of problem signatures, wherein said comparing step said one or more 
event groups with one or more problem signatures includes: 

i. [[a.]] comparing a change in delay during an interval with a threshold; 
1L [[b-]] determining the level of saW short term delay variation during said 
interval; and 

iii. [[c.]] determining whether a preceding interval contains a delay 
impairment ; and 

d. categorizing, by said network analyzer, at least one of said one or more event 
groups as being associated with a network problem having one of said 
plurality of problem signatures; 

wherein said one or more impairments is selected from the group consisting of delay, 
packet loss, jitter, distortion, absolute packet delay variation, relative packet to packet 
delay variation, short term delay variation, short term average delay, timing drift, and 
proportion of out-of-sequence packets; and 

wherein said network problem is selected from the group consisting of local area 
network congestion, access link congestion, route change, access link failure, route 
flapping, and route diversity . 

1 9. (Original) A method as defined in Claim 1 8, wherein categorizing at least one of said 
one or more event groups includes: 

a. when said change in delay exceeds said threshold and said preceding interval 
contains said delay impairment, categorizing said event group as said access 
link congestion. 

20. (Original) A method as defined in Claim 18, wherein categorizing at least one of said 
one or more event groups includes: 
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a. when said change in delay does not exceed said threshold, said preceding 
interval contains a delay impairment, and said level of short term delay 
variation is low, categorizing said event group as said route change. 

21. (Original) A method as defined in Claim 18, wherein categorizing at least one of said 
one or more event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding 
interval does not contain a delay impairment, and said level of short term 
delay variation has increased, categorizing said event group as said local area 
network congestion. 

22-23. (Cancelled.) 

24. (Currently amended) A method as defined in Claim 22, for identifying problems in a 
network environment by a network analyzer operatively connected to a network, the 
method comprising the steps of: 

a. determining, by said network analyzer, during more than one interval, the 
level of one or more impairments, wherein said determining step includes: 

i. determining the delay of a first packet; 

u. determining the delay of a subsequent packet; and 

iii. subtracting the delay of said subsequent packet from the delay of said 
first packet; 

b. grouping, by said network analyzer, said levels of one or more impairments 
into one or more event groups; 

c, comparing, by said network analyzer, said one or more event groups with a 
plurality of problem signatures; and 

d, categorizing, by said network analyzer, at least one of said one or more event 
groups as being associated with a network problem having one of said 
plurality of problem signatures; 
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wherein said one or mor e plurality of problem signatures includes: 

a. a high value of short term delay variation without an increase in delay; 

b. an increase in delay accompanied by an increase in short term delay variation 
followed by a decrease in delay; or 

c. an increase or decrease in delay accompanied by a substantially constant level 
of short term delay variation ; and 

wherein said one or more impairments is selected from the group consisting of delay, 
packet loss, jitter, distortion, absolute packet delay variation, relative packet to packet 
delay variation, short term delay variation, short term average delay, timing drift, and 
proportion of out-of-sequence packets; and 

wherein said network problem is selected from the group consisting of local area 
network congestion, access link congestion, route change, access link failure, route 
flapping, and route diversity . 

25. (Currently amended) A method as defined in Claim 22, for identifying problems in a 
network environment by a network analyzer operatively connected to a network, the 
method comprising the steps of: 

a. determining, by said network analyzer, during more than one interval, the 
level of one or more impairments, wherein said determining step includes: 

i. determining the delay of a first packet; 

ii. determining the delay of a subsequent packet; and 

in. subtracting the delay of said subsequent packet from the delay of said 
first packet; 

b. grouping, by said network analyzer, said levels of one or more impairments 
into one or more event groups; 
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c. comparing, by said network analyzer, said one or more event groups with a 
plurality of problem signatures, wherein said comparing step said one or more 
event groups with one or more problem signatures includes: 

L [[a.]] comparing a change in delay during an interval with a threshold; 

1L [[b.]] determining the level of said short term delay variation during said 
interval; and 

iii. [[c.]] determining whether a preceding interval contains a delay 
impairment ; and 

d. categorizing, by said network analyzer, at least one of said one or more event 
groups as being associated, with a network problem having one of said 
plurality of problem signatures; 

wherein said one or more impairments is selected from the group consisting of delay, 
packet loss, jitter, distortion, absolute packet delay variation, relative packet to packet 
delay variation, short term delay variation, short term average delay, timing drift, and 
proportion of out-of-sequence packets; and 

wherein said network problem is selected from the group consisting of local area 
network congestion, access link congestion, route change, access link failure, route 
flapping, and route diversity . 

26. (Original) A method as defined in Claim 25, wherein categorizing at least one of said 
one or more event groups includes: 

a. when said change in delay exceeds said threshold and said preceding interval 
contains said delay impairment, categorizing said event group as said access 
link congestion. 

27. (Original) A method as defined in Claim 25, wherein categorizing at least one of said 
one or more event groups includes: 
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a. when said change in delay does not exceed said threshold, said preceding 
interval contains a delay impairment, and said level of short term delay 
variation is low, categorizing said event group as said route change. 

28. (Original) A method as defined in Claim 25, wherein categorizing at least one of said 
one or more event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding 
interval does not contain a delay impairment, and said level of short term 
delay variation has increased, categorizing said event group as said local area 
network congestion. 

29. (Currently amended) A method as defined in Claim 7, for identifying problems in a 
network environment by a network analyzer operatively connected to a network, the 
method comprising the steps of: 

a. determining, by said network analyzer, during more than one interval, the 
level of one or more impairments, wherein said determining step the level of 
one or more impairments includes: 

l [[a.]] identifying a first packet having a minimum delay, 

1L [[b.]] subtracting the delay of a second packet from the delay of said 
packet, 

ML [[c]] dividing said subtracted value by the time interval between said first 
and second packets to estimate the rate of change of clock speed; 
and 

iy. [[d.]] incorporating said estimated rate of change of clock speed into an 
average rate of change if said estimated rate of change of clock 
speed exceeds a threshold; 

b. grouping, by said network analyzer, said levels of one or more impairments 
into one or more event groups; 
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c. comparing, by said network analyzer, said one or more event groups with a 
plurality of problem signatures; and 

d. categorizing, by said network analyzer, at least one of said one or more event 
groups as being associated with a network problem having one of said 
plurality of problem signatures; 

wherein said one or more impairments is selected from the group consisting of delay, 
packet loss, jitter, distortion, absolute packet delay variation, relative packet to packet 
delay variation, short term delay variation, short term average delay, timing drift, and 
proportion of out-of-sequence packets; and 

wherein said network problem is selected from the group consisting of local area 
network congestion, access link congestion, route change, access link failure, route 
flapping, and route diversity . 

30-31. (Cancelled) 

32. (Currently amended) A method as defined in Claim 7, for identifying problems in a 
network environment by a network analyzer operatively connected to a network, the 
method comprising the steps of: 

a. determining, by said network analyzer, during more than one interval, the 
level of one or more impairments; 

b. grouping, by said network analyzer, said levels of one or more impairments 
into one or more event groups; 

c. comparing, by said network analyzer, said one or more event groups with a 
plurality of problem signatures; and 

d. categorizing, by said network analyzer, at least one of said one or more event 
groups as being associated with a network problem having one of said 
plurality of problem signatures; 

wherein said one or more plurality of problem signatures includes: 
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a. a high value of short term delay variation without an increase in delay; 

b. an increase in delay accompanied by an increase in short term delay variation 
followed by a decrease in delay; or 

c. an increase or decrease in delay accompanied by a substantially constant level 
of short term delay variation; 

wherein said one or more impairments is selected from the group consisting of delay, 
packet loss, jitter, distortion, absolute packet delay variation, relative packet to packet 
delay variation, short term delay variation, short term average delay, timing drift, and 
proportion of out-of-sequence packets; and 

wherein said network problem is selected from the group consisting of local area 
network congestion, access link congestion, route change, access link failure, route 
flapping, and route diversity . 

33. (Original) A method as defined in Claim 32, further comprising the steps of: 

a. determining the source of more than one call; 

b. grouping said more than one calls into one or more call groups based on the 
source of said more than one calls; 

c. for each call group determining the number of calls having said network 
problem; and 

d. estimating the location of said network problem based on the number of calls 
having said network problem. 

34. (Original) A method as defined in Claim 33, wherein determining the source of more 
than one call includes determining the source internet protocol address of said more 
than one call. 

35. (Previously presented) A method as defined in Claim 33, wherein said estimating step 
further comprises: 
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a. determining the percentage of calls within said call group having said network 
problem; and 

b. estimating that the location of said network problem is at the location 
associated with said call group if the percentage of calls is high. 

36. (Currently amended) A method as defined in Claim 7, for identifying problems in a 
network environment by a network analyzer operatively connected to a network, the 
method comprising the steps of: 

a. determining, by said network analyzer, during more than one interval, the 
level of one or more impairments; 

b. grouping, by said network analyzer, said levels of one or more impairments 
into one or more event groups; 

c. comparing, by said network analyzer, said one or more event groups with a 
plurality of problem signatures, wherein said comparing step said one or more 
event groups with one or more problem signatures includes: 

i. [[a.]] comparing a change in delay during an interval with a threshold; 

ii. [[b.]] determining the level of said short term delay variation during said 

interval; and 

iii. [[c.]] determining whether a preceding interval contains a delay 

impairment ; and 

d. categorizing, by said network analyzer, at least one of said one or more event 
groups as being associated with a network problem having one of said 
plurality of problem signatures; 

wherein said one or more impairments is selected from the group consisting of delay, 
packet loss, jitter, distortion, absolute packet delay variation, relative packet to packet 
delay variation, short term delay variation, short term average delay, timing drift, and 
proportion of out-of-sequence packets; and 
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wherein said network problem is selected from the group consisting of local area 
network congestion, access link congestion, route change, access link failure, route 
flapping, and route diversity . 

37. (Original) A method as defined in Claim 36, wherein categorizing at least one of said 
one or more event groups includes: 

a. when said change in delay exceeds said threshold and said preceding interval 
contains said delay impairment, categorizing said event group as said access 
link congestion. 

38. (Original) A method as defined in Claim 36, wherein categorizing at least one of said 
one or more event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding 
interval contains a delay impairment, and said level of short term delay 
variation is low, categorizing said event group as said route change. 

39. (Original) A method as defined in Claim 36, wherein categorizing at least one of said 
one or more event groups includes: 

a. when said change in delay does not exceed said threshold, said preceding 
interval does not contain a delay impairment, and said level of short term 
delay variation has increased, categorizing said event group as said local area 
network congestion. 



